[arin-ppml] Draft Policy ARIN-2016-8: Removal of Indirect POC Validation Requirement

[Chris Woodfield]

Is the presence of the phrase “will be sent” in the current policy intended to set a requirement for the POC (this email will be sent annually, you must reply to it in order to validate the record), or intended as a requirement for ARIN staff (ARIN is required to send the email annually)?

To the concept of the random audit approach mentioned earlier, It may be simple enough to change “will be sent” to “may be sent”. I’d argue that procedurally the sampling rate should be fairly high, however (i.e. no less than, say, 20% of records).

-C

> On Jan 5, 2017, at 12:46 PM, Owen DeLong <owen at delong.com> wrote:
> 
> I oppose the policy as written.
> 
> While I agree that the validation of indirect POCs by ARIN has become a problem, I believe that this is the exact opposite of a good solution.
> 
> Indeed, my organization has a significant problem with vendors creating indirect POC records pointing to individuals within my organization who are not good POCs for the space in question rather than using our existing POC handles which we have provided to those vendors.
> 
> The current POC validation process is one of the few checks and balances which allows us to catch and address these issues.
> 

P.S. Personally, I’d argue that a viable alternate strategy in the absence of that check/balance would be to make sure that the requirement to use your official POCs is written into your vendor contracts at next renewal, and operationally onto a service acceptance checklist backed up by said contract language.

> Ideally, we would like to have a way for ARIN to flag and validate new POCs pointed at our organization _BEFORE_ they are actually placed into the database or attached to resources.
> 
> Owen
> 
>> On Dec 20, 2016, at 10:09 , ARIN <info at arin.net> wrote:
>> 
>> On 15 December 2016, the ARIN Advisory Council (AC) advanced the following Proposal to Draft Policy status:
>> 
>> ARIN-prop-233: Removal of Indirect POC Validation Requirement
>> 
>> This Draft Policy has been numbered and titled:
>> 
>> Draft Policy ARIN-2016-8: Removal of Indirect POC Validation Requirement
>> 
>> Draft Policy text is below and can be found at:
>> https://www.arin.net/policy/proposals/2016_8.html
>> 
>> You are encouraged to discuss all Draft Policies on PPML. The AC will evaluate the discussion in order to assess the conformance of this draft policy with ARIN's Principles of Internet Number Resource Policy as stated in the Policy Development Process (PDP). Specifically, these principles are:
>> 
>>> Enabling Fair and Impartial Number Resource Administration
>>> Technically Sound
>>> Supported by the Community
>> 
>> The PDP can be found at:
>> https://www.arin.net/policy/pdp.html
>> 
>> Draft Policies and Proposals under discussion can be found at:
>> https://www.arin.net/policy/proposals/index.html
>> 
>> Regards,
>> 
>> Sean Hopkins
>> Policy Analyst
>> American Registry for Internet Numbers (ARIN)
>> 
>> ##########
>> 
>> ARIN-2016-8: Removal of Indirect POC Validation Requirement
>> 
>> Problem Statement:
>> 
>> There are over 600,000 POCs registered in Whois that are only associated with indirect assignments (reassignments) and indirect allocations (reallocations). NRPM 3.6 requires ARIN to contact all 600,000+ of these every year to validate the POC information. This is problematic for a few reasons:
>> 
>> 1) ARIN does not have a business relationships with these POCs. By conducting POC validation via email, ARIN is sending Unsolicited Commercial Emails. Further, because of NRPM 3.6.1, ARIN cannot offer an opt-out mechanism. Finally, ARIN's resultant listing on anti-spam lists causes unacceptable damage to ARIN's ability to conduct ordinary business over email
>> 
>> 2) ARIN has previously reported that POC validation to reassignments causes tremendous work for the staff. It receives many angry phone calls and emails about the POC validation process. I believe the ARIN staff should be focused on POC validation efforts for directly issued resources, as that has more value to internet operations and law enforcement than end-user POC information.
>> 
>> Policy statement:
>> 
>> Replace the first sentence of 3.6.1:
>> 
>> "During ARIN's annual Whois POC validation, an email will be sent to every POC in the Whois database."
>> 
>> with
>> 
>> "During ARIN's annual Whois POC validation, an email will be sent to every POC that is a contact for a direct assignment, direct allocation, reallocation, and AS number, and their associated OrgIDs."
>> 
>> Timetable for implementation: Immediate
>> _______________________________________________
>> PPML
>> You are receiving this message because you are subscribed to
>> the ARIN Public Policy Mailing List (ARIN-PPML at arin.net).
>> Unsubscribe or manage your mailing list subscription at:
>> http://lists.arin.net/mailman/listinfo/arin-ppml
>> Please contact info at arin.net if you experience any issues.
> 
> _______________________________________________
> PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-PPML at arin.net).
> Unsubscribe or manage your mailing list subscription at:
> http://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact info at arin.net if you experience any issues.
>